This vulnerability (CVE-2026-28146) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) is classified as CWE-22, an improper limitation of a pathname to a restricted directory, commonly known as a path traversal flaw. It affects versions up to and including 2.0.14. The flaw allows users with contributor privileges to download arbitrary files from the system, potentially exposing sensitive information. The CVSS 3.1 vector indicates the attack requires network access with low complexity, privileges of a contributor, no user interaction, and impacts confidentiality with high impact but no integrity or availability impact. No vendor advisory or patch information is currently available, and no known exploits have been reported.

An attacker with contributor-level access can exploit this vulnerability to download arbitrary files from the server, potentially leading to disclosure of sensitive information. The confidentiality impact is high, but integrity and availability are not affected. This could expose sensitive data stored on the server to unauthorized users with contributor privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and monitor for unusual file access activities related to this plugin.